How to Identify Entitlements Not Assigned via Roles in SailPoint ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

In SailPoint ISC, entitlements can be assigned either:

  • Automatically through role-based defined assignments, or

  • Manually (e.g., via access requests).

I would like to identify:

  • Users who have entitlements not assigned through roles, and

  • The specific entitlements they hold.

If possible, I also want to limit the scope to a specific source.

Is there a recommended way in ISC (e.g., Search, Reports, or APIs) to achieve this?

Thank you.

2

From API you can check flag standalone:true if it is not assigned via role

3

Interesting. @amankumargupta What endpoint are you calling for that?

4

Hi @sxxnex ,
In Sailpoint iiq you can find this by detected roles ,but In ISC, there is no filter to clearly separate entitlements assigned via roles vs directly, but you can achieve this using API or search.
One approach is to use the Entitlements API / Accounts API and check the assignment type.
If Entitlement/role assigned through Access request ,it will Link as role membership
If it’s directly assigned from backend or target system,it will appear as standalone
Check this via API as
Standalone= true it means directly assigned from backend
Standalone= false assigned via access request

5

Have you tried using

grantedBy/assignmentType in filter and check

6

This should work.

Hit the search API with body as below :

{
“indices”: [
“identities”
],
“query”: {
“query”: “*”,
“innerHit”: {
“type”: “access”,
“query”: “standalone:true AND type:ENTITLEMENT AND source.name:\“Active Directory\””
}
},
“includeNested”: true,
“queryResultFilter”: {
“includes”: [
“name”,
“displayName”,
“access.name”,
“access.source.name”
]
}
}

7

@rahulb635 Brilliant. That works perfectly, thanks

8

Hi @sxxnex ,

You can try generating a preview through search access item certification. The status report should give you only the entitlements solely assigned to users.

Hope this helps.

9

In my testing, searching using standalone:true only returns entitlements that are not associated with an Access Profile. So if you have Roles that assign entitlements directly, not via Access Profiles, those entitlements will show up as being standalone.

There still seems to be a lot of search issues around finding Entitlements that are directly assigned in Roles.

Also Entitlements that are requestable will show up as Standalone.

10

Hi carl,

Agreed with your analysis, for now we can exclude requestable entitlements also.

“query”: “standalone:true AND type:ENTITLEMENT AND NOT requestable:true”

Regarding Roles that assign entitlements directly without AP- you are right.